[SOLVED] SQL Syntax INSERT with _POST Data

[nightcrawler]

$createusername_q = "INSERT INTO checkbook_users ('id', 'username', 'name', 'email', 'password') VALUES (
     NULL, " . $_POST['register_username'] . "," . $_POST['register_name'] . "," . $_POST['register_email'] . "," . $_POST['register_password'];

$createusername = mysql_query($createusername_q)
     or die("Couldn't create username.");

 

Not sure what I'm doing wrong, POST Data goes through fine, variable names are correct.  I think it's just a quotes issue.

 

 

[bubblegum.anarchy]

yeah, apply mysql_real_escape_string() to each $_POST value and add quotes. 

 

... and the ending paranthesis is missing.

[nightcrawler]

$createusername_q = "INSERT INTO checkbook_users (id, username, name, email, password) 
    VALUES (NULL, " . mysql_real_escape_string($_POST['register_username']) . "," . 
    mysql_real_escape_string($_POST['register_name']) . "," . mysql_real_escape_string($_POST['register_email']) . "," .
    mysql_real_escape_string($_POST['register_password']) . ")";

 

How's that look?  it's still not working.

 

 

[nightcrawler]

$register_username = $_POST['register_username'];
$register_name = $_POST['register_name'];
$register_email = $_POST['register_email'];
$register_pw = $_POST['register_password'];

$createusername_q = "INSERT INTO checkbook_users (id, username, name, email, password) 
VALUES (NULL, '$register_username', '$register_name', '$register_email', '$register_password')";

 

This resolved the issue.  I'll mark as solved